emdash 0.36.0 → 0.37.0

package/src/security/ssrf.ts

@@ -467,13 +467,16 @@ const CREDENTIAL_HEADERS = ["authorization", "cookie", "proxy-authorization"];
 export async function ssrfSafeFetch(
 	url: string,
 	init?: RequestInit,
-	options?: { resolver?: DnsResolver },
+	options?: { resolver?: DnsResolver; httpsOnly?: boolean },
 ): Promise<Response> {
 	let currentUrl = url;
 	let currentInit = init;
 
 	for (let i = 0; i <= MAX_REDIRECTS; i++) {
-		await resolveAndValidateExternalUrl(currentUrl, options);
+		const validated = await resolveAndValidateExternalUrl(currentUrl, options);
+		if (options?.httpsOnly === true && validated.protocol !== "https:") {
+			throw new SsrfError("Only HTTPS URLs are allowed");
+		}
 
 		const response = await globalThis.fetch(currentUrl, {
 			...currentInit,

package/src/settings/index.ts

@@ -8,11 +8,13 @@
 import type { Kysely } from "kysely";
 
 import { after } from "../after.js";
+import { siteSettingsTag } from "../cache/chrome-tags.js";
 import { MediaRepository } from "../database/repositories/media.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
 import { cachedQuery, invalidateObjectCache } from "../object-cache/index.js";
+import type { CacheHint } from "../query.js";
 import { peekRequestCache, requestCached } from "../request-cache.js";
 
 /** Object-cache namespace for site settings. */
@@ -236,6 +238,20 @@ export function getSiteSettings(): Promise<Partial<SiteSettings>> {
 	);
 }
 
+/**
+ * Get all site settings with a Workers edge-cache hint.
+ *
+ * Use the returned `cacheHint` with `Astro.cache.set()` so pages that render
+ * settings can be purged automatically when site settings change.
+ */
+export async function getSiteSettingsWithCacheHint(): Promise<{
+	data: Partial<SiteSettings>;
+	cacheHint: CacheHint;
+}> {
+	const data = await getSiteSettings();
+	return { data, cacheHint: { tags: [siteSettingsTag()] } };
+}
+
 /**
  * Get all site settings (with explicit db)
  *

package/src/storage/local.ts

@@ -70,6 +70,7 @@ export class LocalStorage implements Storage {
 		key: string;
 		body: Buffer | Uint8Array | ReadableStream<Uint8Array>;
 		contentType: string;
+		cacheControl?: string;
 	}): Promise<UploadResult> {
 		try {
 			const filePath = this.getFilePath(options.key);

package/src/storage/s3.ts

@@ -157,6 +157,7 @@ export class S3Storage implements Storage {
 		key: string;
 		body: Buffer | Uint8Array | ReadableStream<Uint8Array>;
 		contentType: string;
+		cacheControl?: string;
 	}): Promise<UploadResult> {
 		try {
 			// Convert ReadableStream to Buffer if needed
@@ -180,6 +181,7 @@ export class S3Storage implements Storage {
 					Key: options.key,
 					Body: body,
 					ContentType: options.contentType,
+					CacheControl: options.cacheControl,
 				}),
 			);
 

package/src/storage/types.ts

@@ -162,6 +162,8 @@ export interface Storage {
 		key: string;
 		body: Buffer | Uint8Array | ReadableStream<Uint8Array>;
 		contentType: string;
+		/** Optional HTTP cache policy stored with publicly served objects. */
+		cacheControl?: string;
 	}): Promise<UploadResult>;
 
 	/**

package/src/taxonomies/index.ts

@@ -12,6 +12,7 @@
 
 import { sql, type Kysely } from "kysely";
 
+import { taxonomyTag } from "../cache/chrome-tags.js";
 import type { Database } from "../database/types.js";
 import { validateIdentifier } from "../database/validate.js";
 import { getI18nConfig } from "../i18n/config.js";
@@ -24,6 +25,7 @@ import {
 	invalidateTaxonomyObjectCache,
 	isObjectCacheActive,
 } from "../object-cache/index.js";
+import type { CacheHint } from "../query.js";
 import { peekRequestCache, requestCached, setRequestCacheEntry } from "../request-cache.js";
 import { getRequestContext } from "../request-context.js";
 import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
@@ -318,6 +320,20 @@ export async function getTaxonomyTerms(
 	return withCounts(terms, counts);
 }
 
+/**
+ * Get all terms of a taxonomy with a Workers edge-cache hint.
+ *
+ * Use the returned `cacheHint` with `Astro.cache.set()` so pages that render
+ * a taxonomy facet can be purged automatically when taxonomy terms change.
+ */
+export async function getTaxonomyTermsWithCacheHint(
+	taxonomyName: string,
+	options: TaxonomyTermsOptions = {},
+): Promise<{ data: TaxonomyTerm[]; cacheHint: CacheHint }> {
+	const data = await getTaxonomyTerms(taxonomyName, options);
+	return { data, cacheHint: { tags: [taxonomyTag(taxonomyName)] } };
+}
+
 /** Terms without counts, under the cache keys the layout prefetch warms. */
 function getTermList(def: TaxonomyDef, locale: string | undefined): Promise<TaxonomyTerm[]> {
 	const localeKey = locale ?? "*";
@@ -420,23 +436,37 @@ function getVisibleTermCounts(
  * Get a single term by (taxonomy, slug). Honours the fallback chain — if the
  * slug exists in a fallback locale, we return that row (useful for deep-linking
  * to a term page when the translation is missing).
+ *
+ * The term row and its visible-entry count are loaded and cached separately: the
+ * row depends only on the taxonomy epoch, while the count adds an aggregate over
+ * the whole assignment pivot and every counted collection's content epoch. A
+ * caller that renders no count passes `includeCounts: false` and skips it.
  */
 export async function getTerm(
 	taxonomyName: string,
 	slug: string,
-	options: TaxonomyQueryOptions = {},
+	options: TaxonomyTermsOptions = {},
 ): Promise<TaxonomyTerm | null> {
 	const chain = resolveLocaleChain(options.locale);
-	// The def supplies the collections the visible count is scoped to. It is
-	// resolved before cachedQuery so the entry lives under each collection's
-	// content namespace — publishing or unpublishing an entry invalidates the
-	// embedded count (see termCountNamespaces).
-	const def = await getTaxonomyDef(taxonomyName, options);
-	const collections = def?.collections ?? [];
+	const term = await getTermRow(taxonomyName, slug, chain);
+	if (!term) return null;
+	if (options.includeCounts === false) return term;
+
+	const collections = (await getTaxonomyDef(taxonomyName, options))?.collections ?? [];
+	const counts = await getVisibleTermCounts(taxonomyName, collections, chain[0] ?? term.locale);
+	return { ...term, count: counts.get(term.translationGroup ?? term.id) ?? 0 };
+}
+
+/** A single term with its children, without counts, under the taxonomy epoch. */
+function getTermRow(
+	taxonomyName: string,
+	slug: string,
+	chain: string[],
+): Promise<TaxonomyTerm | null> {
 	return cachedQuery({
-		namespace: termCountNamespaces(collections),
+		namespace: CacheNamespace.TAXONOMIES,
 		key: `term:${taxonomyName}:${slug}:${chain.join(",")}`,
-		load: () => loadTerm(taxonomyName, slug, chain, collections),
+		load: () => loadTerm(taxonomyName, slug, chain),
 	});
 }
 
@@ -444,7 +474,6 @@ async function loadTerm(
 	taxonomyName: string,
 	slug: string,
 	chain: string[],
-	collections: string[],
 ): Promise<TaxonomyTerm | null> {
 	const db = await getDb();
 
@@ -479,15 +508,7 @@ async function loadTerm(
 	const termLocale = row.locale;
 	if (termLocale) childrenQuery = childrenQuery.where("locale", "=", termLocale);
 
-	// The visible-usage counts and children queries both depend only on the
-	// term row, so run them concurrently to save a round trip on remote
-	// databases. The counts map is request-cached per taxonomy — on a page
-	// that also renders the taxonomy widget it's a free Map lookup.
-	const [counts, childRows] = await Promise.all([
-		getVisibleTermCounts(taxonomyName, collections, chain[0] ?? row.locale),
-		childrenQuery.execute(),
-	]);
-	const count = counts.get(row.translation_group ?? row.id) ?? 0;
+	const childRows = await childrenQuery.execute();
 
 	const children = childRows.map<TaxonomyTerm>((child) => ({
 		id: child.id,
@@ -508,7 +529,6 @@ async function loadTerm(
 		parentId: row.parent_id ?? undefined,
 		description: row.data ? JSON.parse(row.data).description : undefined,
 		children,
-		count,
 		locale: row.locale,
 		translationGroup: row.translation_group,
 	};

package/src/widgets/archives.ts

@@ -0,0 +1,67 @@
+export type ArchiveGroupType = "monthly" | "yearly";
+
+export interface ArchiveGroup {
+	label: string;
+	count: number;
+	url: string;
+}
+
+function toPublishedDate(value: unknown): Date | null {
+	if (value instanceof Date) {
+		return Number.isNaN(value.getTime()) ? null : value;
+	}
+	if (typeof value === "string" || typeof value === "number") {
+		const date = new Date(value);
+		return Number.isNaN(date.getTime()) ? null : date;
+	}
+	return null;
+}
+
+/**
+ * Group collection entries by published date for the Archives widget.
+ *
+ * Accepts `Date` objects, ISO strings, and numeric timestamps; `getEmDashCollection()`
+ * returns `publishedAt` as a `Date`.
+ */
+export function groupEntriesByPublishedAt(
+	entries: Array<{ data: { publishedAt?: unknown } }>,
+	options: { type?: ArchiveGroupType; limit?: number } = {},
+): ArchiveGroup[] {
+	const type = options.type ?? "monthly";
+	const limit = options.limit ?? 12;
+	const archives = new Map<string, ArchiveGroup>();
+
+	for (const entry of entries) {
+		const date = toPublishedDate(entry.data.publishedAt);
+		if (!date) continue;
+
+		let key: string;
+		let label: string;
+		let url: string;
+
+		if (type === "yearly") {
+			const year = date.getFullYear();
+			key = `${year}`;
+			label = `${year}`;
+			url = `/archives/${year}`;
+		} else {
+			const year = date.getFullYear();
+			const month = date.getMonth() + 1;
+			key = `${year}-${month.toString().padStart(2, "0")}`;
+			label = date.toLocaleDateString("en-US", {
+				year: "numeric",
+				month: "long",
+			});
+			url = `/archives/${year}/${month.toString().padStart(2, "0")}`;
+		}
+
+		const existing = archives.get(key);
+		if (existing) {
+			existing.count++;
+		} else {
+			archives.set(key, { label, count: 1, url });
+		}
+	}
+
+	return [...archives.values()].slice(0, limit);
+}

package/src/widgets/index.ts

@@ -1,4 +1,6 @@
+import { widgetAreaTag } from "../cache/chrome-tags.js";
 import { getDb } from "../loader.js";
+import type { CacheHint } from "../query.js";
 import { requestCached } from "../request-cache.js";
 import { getWidgetComponents as getComponentRegistry } from "./components.js";
 import type { Widget, WidgetArea, WidgetRow, WidgetComponentDef } from "./types.js";
@@ -83,6 +85,20 @@ export async function getWidgetArea(name: string): Promise<WidgetArea | null> {
 	});
 }
 
+/**
+ * Get a widget area by name with a Workers edge-cache hint.
+ *
+ * Use the returned `cacheHint` with `Astro.cache.set()` so pages that render
+ * this widget area can be purged automatically when its widgets change.
+ */
+export async function getWidgetAreaWithCacheHint(name: string): Promise<{
+	data: WidgetArea | null;
+	cacheHint: CacheHint;
+}> {
+	const data = await getWidgetArea(name);
+	return { data, cacheHint: { tags: [widgetAreaTag(name)] } };
+}
+
 /**
  * Get all widget areas with their widgets
  */